The present invention relates to the Internet. More specifically, the present invention relates to Internet security features.
The use of the Internet by both individuals and businesses has increased dramatically during the last few years. One area that has seen particularly robust growth is the introduction by cable television providers of Internet service over the existing cable television infrastructure. This type of system typically known as “always on, rarely protected” is used extensively in homes, schools, libraries and other venues without trained system administration and security staff. This has exacerbated problems caused by individuals attempting to bring down computer systems connected to the Internet in such a manner.
Denial of service (DOS) attacks, for example, are one type of attack that are an increasing problem. While some DOS attacks exploit subtle flaws in the host being attacked, the most basic low level attacks are based on bandwidth exhaustion. That is, the links (usually one) to the host being attacked are so saturated with DOS traffic that legitimate packets cannot get through. Because such denial of service attacks do not depend on any flaw at the target host, no fix at the host can solve them.
Typically, a DOS target host or target local network is connected to the Internet via a router or firewall such that there is considerably greater bandwidth between the Internet and the firewall/router than there is between the firewall/router and the target host. In a low level DOS attack, the flood of traffic on the one or more connections between the firewall/router and the Internet cannot be supported by the smaller connection between the firewall/router and the target, which results in high packet loss at the firewall/router. Legitimate packets that are dropped are denied transport to the host which leads to the general denial of Internet service.
With the current state of the Internet, such attacks become a bandwidth contest. If the attacker has more bandwidth at their command than the link (or links) to the target, the attacker wins unless effective countermeasures have been implemented at the defensive firewall/router.
Countermeasures that have been taken thus far have been quite crude and damaging, such as blocking all Internet Control Message Protocol (ICMP) echo packets, since the packets are used by some denial of service tools. Such blockage, though, stops legitimate use of the “ping” traceroute facilities for network management. Narrower blocking may consist of throwing away all packets from a particular block of IP source addresses. However, this can only be done after it has been determined that an attack is coming from those particular addresses.
Accordingly, there exists a need for an improved method of defending against attacks on a host server.